CVE-2017-0497

Vulnerability

A denial of service vulnerability exists in the Mediaserver component of Android versions 7.0 and 7.1.1. The bug can be triggered by a specially crafted file, leading to a device hang or reboot. The issue is rated as Moderate because it requires an uncommon device configuration to be exploitable. [1][2]

Exploitation

An attacker needs to deliver a specially crafted file to the target device, which when processed by Mediaserver causes the denial of service. No authentication or special privileges are required beyond the ability to introduce the file (e.g., via a malicious app or web content). The uncommon device configuration may involve specific hardware or software settings that make the code path reachable. [1][2]

Impact

Successful exploitation results in a denial of service, causing the device to hang or reboot. This disrupts device availability and may lead to temporary loss of functionality. No data confidentiality or integrity impact is reported. [1][2]

Mitigation

The vulnerability is addressed in the Android security patch level of 2017-03-05, as part of the March 2017 Security Bulletin. Users should ensure their devices receive the update. No workarounds are documented. [1][2]